You are setting up Aruba ClearPass Policy Manager (CPPM) to enforce EAP-TLS authentication with Active Directory as the authentication source. The…

To check the status of a user account in Active Directory (AD), ClearPass Policy Manager (CPPM) must be configured to retrieve the userAccountControl attribute during the authentication process. This is accomplished by adding this specific attribute to the filter configuration of the AD authentication source. The userAccountControl attribute is a bitmask field in AD that contains flags indicating the account's properties, including whether it is enabled or disabled. Once CPPM fetches this attribute, enforcement policies can be created to check its value and deny access to users with disabled accounts, fulfilling the requirement.

A: Endpoint Context Servers are used to gather supplementary endpoint data (e.g., from an MDM), not as the primary mechanism for user account status checks during authentication.

B: OCSP (Online Certificate Status Protocol) is used exclusively to verify the revocation status of a digital certificate, not the status of a user's account in Active Directory.

D: ClearPass Guest is the module for guest access, onboarding, and self-service portals. Core authentication source configuration for 802.1X is managed in ClearPass Policy Manager.

1. Aruba ClearPass Policy Manager 6.11 User Guide

Chapter: "Identity > Authentication > Sources"

Section: "Adding an Active Directory Authentication Source". The guide details the configuration tabs for an AD source

including the "Attributes" tab where you define the attributes to be fetched from the directory. To use userAccountControl in policies

it must first be added as an attribute to be retrieved here.

2. Aruba ClearPass Workshop v6.7 Lab Guide (Official Courseware)

Lab 4: "802.1X EAP-PEAP with Active Directory". This lab demonstrates configuring an AD authentication source and then using fetched attributes (like memberOf) in Role Mapping and Enforcement Policies. The same principle directly applies to fetching and using the userAccountControl attribute for account status checks.

3. Microsoft Active Directory Documentation

"User-Account-Control attribute". This official documentation defines the userAccountControl attribute and its bitmask values. The flag for a disabled account is ADSUFACCOUNTDISABLE with a value of 2. This confirms it is the correct attribute for CPPM to query to determine account status. (This source validates the purpose of the attribute itself).